500-220 Engineering Cisco Meraki Solutions (ECMS) v2.2 Questions and Answers

https://documentation.meraki.com/SM/Monitoring_and_Reporting/Selective_Wipe_and_Device_Quarantine_in_Systems_Manager

See Permissions by Network Tag section To simplify the assignment of network-level permissions in an organization with many networks, permissions can be granted to users for a given network tag. https://documentation.meraki.com/General_Administration/Managing_Dashboard_Access/Managing_Dashboard_Administrators_and_Permissions

The Organization > Configure > Manage Tags page allows Administrators to configure a combination of Network and Device specific tags to create Summary Reports filtered for specific devices across multiple networks. https://documentation.meraki.com/General_Administration/Organizations_and_Networks/Organization_Menu/Manage_Tags

To clarify, when an SSID is configured with Sign-On Splash page enabled, the two settings that must be configured for unauthenticated clients to have full network access and not be allow listed are:

• Controller disconnection behavior: This setting determines how the clients are treated when the Meraki cloud controller is unreachable. The options are Restricted or Unrestricted. The former option blocks all traffic from unauthenticated clients until the controller is reachable again. The latter option allows unauthenticated clients to access the network without signing on until the controller is reachable again1.
• Captive Portal strength: This setting determines how often the clients are redirected to the splash page for authentication. The options are Block all access until sign-on is complete or Allow non-HTTP traffic prior to sign-on. The latter option allows unauthenticated clients to access other protocols such as DNS, DHCP, ICMP, etc., but blocks HTTP and HTTPS traffic until they sign on. This option is recommended for compatibility with devices that do not support web-based authentication1.

On the device, navigate to Settings > General > Device Management

Select Meraki Management, and select Remove to delete the management profile and any managed configuration profiles installed via SM

See Behavior - Firmware MX 15.11 or Lower section For MXs running firmware MX15.11 or below, the source IP that MX uses while pinging a destination is the MX IP of highest VLAN ID. If the destination is across a VPN, the MX uses the MX IP of highest VLAN ID participating in VPN. For MXs running firmware MX 15.12+, additional ping options have been added to the live tool. The ping tool now has a drop down to select the source IP address for pinging destinations from the MX. https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Ping_Live_Tool

IOS:

• Kiosk mode
• Single App mode
• Wallpaper
• Cisco Security Connector
• Active Sync

Android:

• Kiosk mode
• Backpack
• Wallpaper
• Active Sync

This question is related to the topic of System Manager: Getting Started in the Cisco Meraki documentation. You can find more information about this topic in the [System Manager: Getting Started] article or the [System Manager Overview] page.

https://documentation.meraki.com/SM/Profiles_and_Settings/Configuration_Settings_Payloads

Ports used to contact the VPN registry:

- Source UDP port range 32768-61000

- Destination UDP port 9350 or UDP port 9351

Ports used for IPsec tunneling:

- Source UDP port range 32768-61000

- Destination UDP port range 32768-61000

https://documentation.meraki.com/MX/Site-to-site_VPN/Meraki_Auto_VPN_-_Configuration_and_Troubleshooting

To clarify, to optimize load balancing asymmetrically with a 4:1 ratio between links, two actions that are required are:

• Enable load balancing: This option allows the MX to use both of its uplinks for load balancing. When load balancing is enabled under Security & SD-WAN > Configure > SD-WAN & Traffic shaping, traffic flows will be distributed between the two uplinks proportional to the WAN 1 and WAN 2 bandwidths specified under Uplink configuration1.
• Change the assigned speeds of WAN 1 and WAN 2 so that the ratio is 4:1: The assigned speed of a WAN link is a value that indicates the bandwidth available on that link. By changing the assigned speeds of WAN 1 and WAN 2 so that they reflect the desired load-balancing ratio, the administrator can ensure that the MX uses both links efficiently and proportionally1. For example, if WAN 1 has a bandwidth of 100 Mbps and WAN 2 has a bandwidth of 25 Mbps, then setting their assigned speeds to 100 Mbps and 25 Mbps respectively will achieve a 4:1 load-balancing ratio.

https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/Best_Practice_Design_-_MR_Wireless/High_Density_Wi-Fi_Deployments

https://documentation.meraki.com/General_Administration/Managing_Dashboard_Access/Configuring_SAML_Single_Sign-on_for_Dashboard

By default, iOS apps provisioned through Systems Manager that are found in the App Store will self-update if automatic updates has been turned on in the Settings. For custom iOS apps, or to manually push down updates, check the following steps. https://documentation.meraki.com/SM/Apps_and_Software/Updating_Managed_iOS_Apps

You can enable intrusion prevention by setting the Mode drop-down to Prevention under Security & SD-WAN > Configure > Threat protection > Intrusion detection and prevention. Traffic will be automatically blocked by best effort if it is detected as malicious based on the detection ruleset specified above. https://documentation.meraki.com/MX/Content_Filtering_and_Threat_Protection/Threat_Protection

Route Priority

Each type of route configured on the MX has a specific priority in comparison with other types of routes. The priority is as follows:

Directly Connected

Client VPN

Static Routes

AutoVPN Routes

Non-Meraki VPN Peers

BGP learned Routes

NAT*

https://documentation.meraki.com/MX/Networks_and_Routing/MX_Routing_Behavior

The correct answer is B and D. These are the two methods of targeting and applying management profiles to System Manager clients, according to the [System Manager: Getting Started] article. The article explains that:

• Defining the scope: This method allows you to target devices based on their network, tag, or owner. You can define the scope of a profile from the Systems Manager > Manage > Settings page or from the Systems Manager > Monitor > Overview page.
• Using device tags: This method allows you to target devices based on their attributes, such as OS, model, location, or user. You can use device tags to create dynamic groups of devices that share common characteristics. You can apply device tags from the Systems Manager > Monitor > Devices page or from the Systems Manager > Manage > Tags page.

This is because the alert mentions 802.1X failure, which is a network access control method that is used with WPA2-enterprise and RADIUS servers1.

This question is related to the topic of Wireless Access Points Quick Start in the Cisco Meraki documentation. You can find more information about this topic in the Wireless Access Points Quick Start article or the Using the Cisco Meraki Device Local Status Page page.

https://documentation.meraki.com/MR/Deployment_Guides/Mesh_Deployment_Guide

There will be a throughput reduction (~50% reduction) with each “hop” in a mesh. It is recommended that a mesh network be designed for no more than one mesh hop from the gateway to client device.

https://documentation.meraki.com/MV/Initial_Configuration/Privacy_Windows